![[Main Page]](http://www.eurasia.nu/images/svico_t.gif)
This dev unit is a gamecube that runs on a cart containing a hard drive (IDE) that has "slots" for anywhere from 1-4 games depending on the cart.
tmbinc @ http://assemblergames.com/forums/showthread.php?t=5402 (<--- more shots from opened NPDP gamecube here)
I spent quite a lot of time reversing the firmware for the cartridges (as it already has been said: the clever part is in the cartridge, the console itself is a straight DVD-Interface brought to the special connector).
Basically they use a SH-3 CPU plus an FPGA (and some smaller stuff) to interface the DI ("disk (or dvd) interface") to the IDE hdd.
There's hardcoded support for 4 disc images, which are at different offsets. The data itself is crypted with a stupid algorithm (stupid because it's XOR with a 32bit fixed key, and there is a lot of zero in the first sector of every gamecube game...), which depends on the so-called "NPDP-ID". Oh, and the special constant 0xdeadbeef plays into this calculation as well ;) for example, my XOR mask was d8 ae ca ad (now, nintendo, go and derive where i got my cartridge from= ;)=
The harddiscs are locked with a key depending on the NPDP-ID as well, so you can't just swap the drives from two different cartridges. However, the security level is set to "high" (vs. "highest"), and the master-password is "N-PDP Master Passwd", maybe byteswapped (depends on your view).
So it's easily possible to unlock the drives, and read/write the contents.
The disc itself reports with some bits set in the first 32bits of the "IDENTIFY"-response (whereas DVD-drives have 00 there..), and to access the data you first have to issue an "NPDP-ID"-command (yes, ascii :), which will give you the string displayed when you switch on an npdp-console.
By the way, NPDP-Consoles have a special IPL (if anybody has a rip of the PAL one, i would be glad to get it ;), basically just to display the "this NPDP belong to..." in the beginning.
Then there are special commands (F0..F6) to do direct reads (reading absolute sectors), flashing the firmware, writing to it (these "NPDP Gang Writers" seem to use that interface - i have never seen them, though.).
I never managed to use these commands, as they seem to require some setup.
You can exchange the harddrive, but be careful, the Cartridge will lock them, so have an unlocking application ready. (please don't ask me for it as i wrote a special application for some embedded device having an IDE bus, as i didn't managed to do that with an USB-housing and i didn't wanted to have to reboot all the time ;)
You can use a smaller harddrive (and thus using less than the 4 images) or a bigger one, but you can't use more than the 4. I looked at any way overriding this offset, but didn't suceed. :(
(don't worry, i of course swapped some bits in the key :)